Hello, In a splunk search, the first transforming command is processed on the indexers and processed data is transfered to the Search Heads so that the rest of the search is done there. Do you know where is stored this intermediate data on the Search Heads? I've looked into the dispatch directory (/opt/splunk/var/run/splunk/dispatch/<sid>/) but I've seen nothing relevant. Is it in RAM? If you've got any docs related to this I'd love to read it! Thanks ... View more